Babelfish for PostgreSQL: Improper access control vulnerability (CVE-2026-119922)
An improper access control vulnerability in Babelfish for PostgreSQL versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, and 5.1-5.4 may allow remote authenticated users to elevate their privileges.
CVE search metadata
CVE search record: CVE-2026-119922. Severity: high. CVSS: 8.8. KEV: no. Brief: Babelfish for PostgreSQL: Improper access control vulnerability (CVE-2026-119922). Brief link: https://feed.craftedsignal.io/briefs/2026-11-babelfish-access-control/
Triage facts
Revision 2- Evidence
- Unknown
- Severity
- High
- Sources
- 2 public sources
- Freshness
- Revision 2Nov 3, 21:28 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Revision history 1 entry · Revision 2
- Revision 2
poc_available
Changed: affected_vendors, claim_state, has_poc, lastmod, poc_references, references, updates
Sources: 1
Babelfish for PostgreSQL versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, and 5.1-5.4 contain an improper access control vulnerability (CVE-2026-119922) that may allow remote authenticated users to elevate their privileges. The CVSS v3.1 base score for this vulnerability is 8.8. To remediate this issue, it is recommended to upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later.